Cerebral, a California-based mental health startup, exposed the personal data of up to 3.1 million people, in some cases potentially revealing sensitive information regarding mental health treatment, CNN reports. The “inadvertent” data leak comes three years after the startup began using “pixels,” a widespread method used by companies to track user behavior for marketing. Users’ responses to a mental health questionnaire on Cerebral’s website—which asks about personal topics like panic attacks and substance abuse—may be included in the leak. Cerebral has reported the data exposure to the Department of Health and Human Services. The company told CNN it’s “committed to correcting historical errors and leading the industry in privacy standards moving forward.”